Building a Distributed Semantic-aware Security Architecture

Abstract. Enhancing the service-oriented architecture paradigm with semantic components is a new field of research and goal of many ongoing projects. The results lead to more powerful web applications with less development effort and better user support. While some of these ad-vantages are without doubt novel, challenges and opportunities for the security arise. In this paper we introduce a security architecture built in a semantic service-oriented architecture. Focusing on an attribute-based access control approach, we present an access control model that facilitates semantic attribute matching and ontology mapping. Further-more, our security architecture is capable of distributing the Policy De-cision Point (PDP) from the service provider to different locations in the platform, eliminating the need of disclosing privacy-sensitive user attributes to the service provider. With respect to privacy preferences of the user and trust settings of the service provider, our approach allows for dynamically selecting a PDP. With more advanced trusted compu-ting technology in the future it is possible to place the PDP on user side, reaching a maximum level of privacy.